openseasprojct1[.]vercel[.]app

On July 23, 2026, the domain openseasprojct1.vercel.app was identified as a high‑risk brand‑impersonation vector targeting OpenSea. The domain was created on February 21, 2026 and is registered through Tucows Domains Inc. DNS resolution points to IP address 64.29.17.195, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. Network analysis shows the site is hosted on Vercel infrastructure and serves HTTP Strict Transport Security headers, indicating an attempt to present a legitimate security posture. The TLS certificate presented is issued by Google Trust Services under the WR1 certificate authority, further mimicking a trusted service.

The site currently returns HTTP status 451 (Unavailable for Legal Reasons) and the page title reported by automated crawlers is "Deployment Unavailable," confirming that the content has been taken offline. Despite the offline state, the domain is listed on two security blocklists—PhishDestroy and ScamSniffer—and Google Safe Browsing flags it for social engineering, consistent with the reported crypto‑scam classification. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain, providing additional corroboration of malicious intent.

Evidence suggests that the domain was actively used to impersonate OpenSea, likely to lure cryptocurrency‑related victims, although the exact payload or phishing page content has not been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering policies to include the observed blocklist indicators, and monitor for any resurgence of activity on the associated IP address. Threat‑intel teams should correlate this indicator with other OpenSea‑related campaigns to assess potential overlap, and incident response units should advise users to verify OpenSea URLs against official domains before any transaction. The current offline status does not preclude future re‑use; ongoing surveillance is recommended.